Small digital businesses globally – including those based in Europe – have taken a hit today as the Court of Justice of the European Union (CJEU) ruled that the EU/US 2000 Safe Harbour agreement is invalid. This decision, though it only directly impacts the parties to the case, calls into question the legality of any company storing or moving internationally the data of European citizens.
For 15 years the Safe Harbour Agreement has enabled US companies to certify that they meet the “adequacy” standard for privacy protection in the EU, where standards are considered to be much stronger than in most third countries. The Apps Alliance is concerned that invalidating Safe Harbour will have an immediate negative impact on companies operating on both sides of the Atlantic, and which employ hundreds of thousands of EU workers and contribute substantially to the European economy. The Alliance is particularly concerned that European digital startups and innovators – all of which have global aspirations – will have difficulties accessing and benefitting from global markets and efficiencies as a result of this ruling.
In addition to our substantive concern with the CJEU decision, we are perplexed by the speed at which it was issued. After receiving the Advocate General’s Advisory Opinion the CJEU typically reaches its judgment 3-6 months later. In this instance, the CJEU issued its ruling in less than 2 weeks. This has led some to question whether the ruling was politically motivated, perhaps to put pressure on EU/US negotiators to accelerate separate and ongoing negotiations on a new and improved Safe Harbour agreement.
Some are also suggesting that the real issue at stake is the EU’s ever-growing concerns over US government surveillance. In the wake of the Snowden revelations, the EU correctly became cautious of transatlantic data flows with the US. However, it appears that the US may be responding to the EU’s wider concerns about data transfer risks by modifying its own surveillance activities and by progressing toward legislation that will offer EU citizens the right to judicial redress in the US.
If government surveillance was the EU’s main reason for ending the Safe Harbour agreement, the Apps Alliance believes that this should have been dealt with separately from Safe Harbour, as it could impact other data transfer agreements the EU has with third countries.
The rushed decision has also led others to wonder what will happen immediately, or if no new Safe Harbour agreement is reached. With no Safe Harbour agreement, each of the EU’s 28 Data Protection Authorities will decide how their respective citizens’ data is collected and processed internationally. How will this affect European digital companies that work with European citizens located globally, with data systems that are global, and with international consumers and partners?
The Apps Alliance welcomes high levels of protection for European citizens’ personal data, but lacking a common process for data transfers to third countries could lead to 28 interpretations of the 1995 data protection directive by individual Member States. This appears to contradict the EU’s plans for a Digital Single Market Strategy, which aims to tear “down regulatory walls” and move “from 28 national markets to a single one”. By doing so the EU hopes to create hundreds of thousands of new jobs and add €415 billion annually to the economy.
Commercial data flows are indispensable to international trade and the CJEU decision appears to target large US tech companies with operations in Europe. However, the Apps Alliance is worried about the well-intended small companies, many of which depend on data transfers in order to continue to operate. Unlike big tech companies, our digital startups and small innovators do not have the time, resources or expertise to fight big legal battles.
According to the European Commission’s DG GROW, one of the EU’s main objectives is to create a business-friendly environment for existing small and medium-sized enterprises. But since the majority of Safe Harbour participants are small businesses, it is unclear how invalidating the agreement would benefit SMEs.
With that in mind, getting rid of the 2000 Safe Harbour agreement is very short-sighted and a huge step backwards for the EU. It could be a massive blow to thousands of European jobs that depend on data transfers, in addition to undermining the EU’s position as a global trading partner and harming countless SMEs and startups.
For further reading, please see the Court of Justice press release and full judgment.
Catriona Meehan
Director of European Policy & Government Relations
